1280-bit keys are still mostly sufficient for now, this isn’t a website where every party is relying on the key of the server being heavily resistant to protects millions of users - every device has a unique key.

Still, you are correct that a determined adversary, potentially one capable of purchasing a quantum computer with enough quibits could factor the device key. It would be nice to see Apple move to a large enough ECC key which would improve security against quantum computing attacks in particular.

I don’t think there any quantum computers yet? The last I heard there was one example of factoring 15 and I think it assumed the factors?

Did something change?

True ones are still off in the near future, ones with enough quibits for Shor’s algorithm are far enough away for now as well - which is why I generally feel safe with the current level of cryptography Apple uses with iMessage.

I won’t underestimate the rate at which they are developed though, it takes 2x the key size as the number of quibits to run Shor’s algorithm - ~2600 is a lot smaller than 4096, and even then who knows how much time we have until that happens.